Large batch of domains stolen from Norwegian domainer – How did they do it?

A large batch of mostly LLLL .com domain names has been stolen from its rightful owner, Norwegian domainer Rune Holte.

This post serves both as an alert to the list of stolen domains and a ping to the rightful owner, who’s quite probably unaware of the theft.

GMIX.com was offered for sale on DNForum by an 8-month old forum member, with no previous posts. GMIX.com is a 13-year old domain name that did not change hands until the beginning of August.

In the sales thread, the seller claimed they held the domain for 11 years, whereas historic WHOIS at DomainTools shows that the domain was moved from Moniker to GoDaddy and then it changed ownership to a “John Martin” with a fake California address.

So how did the thieves do it?

GMIX.com – along with several other domains that we will list below – had a Norwegian .no email address as the registrant, admin and technical contacts.

The problem is, that domain was left to expire and drop; its holder, Rune Holte, was most likely unaware of this.

Apparently, the thieves noticed that GMIX.com was a “domain orphan” and they simply went ahead and re-registered its parent, akuttklinikken.no.

Then, the thieves hosted akuttklinikken.no and re-enabled the admin email, rune@akuttklinikken.no which gave them access to the Moniker account containing GMIX.com and other domains.

That’s why it’s important to have two-way authentication available and enabled at all domain registrars!

Currently, the sales thread at DNForum was moved to the Legal & Issues section; pending further analysis. From our review, the seller is an Algerian residing in France, that tried to convince the forum members he’s in fact a Norwegian living in the US.

Comments

What a S.O.B. I saw this thread and boy, the Domainers of the world are lucky to have you folks dong what you do. It is refreshing to see strangers helping each other out in this industry. Now, who do we now in France that can track the mofo down and tar and feather him?

I bought these domains through Godaddy Auctions. …I called GoDaddy.com. They advised me since all the transactions are verified and gone through right channels..that’s is through Godaddy. Godaddy sold these domains from the rightful owners to me. I am legally and fully protected by godaddy and as there is no illegal activity here. So I advice you or anyone who want to talk please call (480) 505-8877 Godaddy customer support. They advised to directly call godaddy legal and Godaddy support anytime.

Congratulations! You have placed the winning bid for Item Number 102720014, GMIX.com, in the amount of $800.00.

To complete your purchase by 04/22/2013 02:12 PM:
Click here and log in if prompted.
Select GMIX.com and click the “Pay for this domain” link.

Remember that in accordance with the legal agreement you acknowledged at the time of your bid (Universal Terms of Service, UTOS), we will start a change of registrant and renewal immediately upon payment. Once renewed, the name cannot be transferred away for 60 days.

If you have any questions, Customer Support is available 24 hours a day, 7 days a week:

A year ago today!

DomainGang provides daily entertainment and parody content for the domain industry! Articles that contain the “100% True” notice are entirely true – but still fun to read. Follow us, and learn more about the wonderful world of domaining! 😀

Disclaimer: All posts, information and content on the web site DomainGang.com are fictional, humorous and depict a satire - unless a "100% True" image or statement is present.
DomainGang.com provides entertainment via the public release of content related to the domaining industry and social media. We are not to be held responsible for any damage caused by your failure to comprehend the context of satiric content. By accessing DomainGang.com and perusing the DomainGang.com information and content you fully agree that you are aware of and consent to this Disclaimer.